# Nexus ldap issue

## post by abhilash.sandupatla on Feb 7, 2022

I am using Sonatype Nexus Repository Manager OSS 3.37.3-02.

I can establish the connection with the LDAP server, and I can verify the user mapping as well.

I am able to login with LDAP users, but sometimes, it throws an error, authentication failed.

A number of users face the same issue, very often. After a couple of tries, again it authenticates.

Here, I am attaching the nexus logs for reference.

```auto
2022-02-03 02:33:45,193+0000 DEBUG [qtp1045754506-9146]  *UNKNOWN org.sonatype.nexus.ldap.internal.realms.EnterpriseLdapManager - Ldap User: helm.user@example.com not found in cache.
2022-02-03 02:33:45,194+0000 DEBUG [qtp1045754506-9146]  *UNKNOWN org.sonatype.nexus.ldap.internal.connector.FailoverLdapConnector - isOriginalConnectorValid=TRUE 1643830583243+300000 < 1643855625194
2022-02-03 02:33:45,194+0000 DEBUG [qtp1045754506-9146]  *UNKNOWN org.sonatype.nexus.ldap.internal.realms.DefaultLdapContextFactory - Initializing LDAP context using URL [ldaps://ldap.us.onelogin.com:636/dc=example,dc=onelogin,dc=com] and username [cn=pie-nexus@example.com,ou=users,dc=example,dc=onelogin,dc=com] with pooling [enabled] and environment {java.naming.referral=follow, com.sun.jndi.ldap.connect.timeout=90000, java.naming.security.principal=cn=pie-nexus@example.com,ou=users,dc=example,dc=onelogin,dc=com, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, com.sun.jndi.ldap.connect.pool=true, java.naming.security.sasl.realm=, java.naming.
vider.url=ldaps://ldap.us.onelogin.com:636/dc=example,dc=onelogin,dc=com, java.naming.security.credentials=***, java.naming.security.authentication=simple}
2022-02-03 02:33:45,194+0000 DEBUG [qtp1045754506-9146]  *UNKNOWN org.sonatype.nexus.ldap.internal.connector.dao.DefaultLdapUserDAO - Searching for user: helm.user@example.com
2022-02-03 02:33:45,195+0000 DEBUG [qtp1045754506-9146]  *UNKNOWN org.sonatype.nexus.ldap.internal.connector.dao.DefaultLdapUserDAO - Specific filter rule: ""
2022-02-03 02:33:45,195+0000 DEBUG [qtp1045754506-9146]  *UNKNOWN org.sonatype.nexus.ldap.internal.connector.dao.DefaultLdapUserDAO - Searching for users with filter: '(&(objectClass=inetOrgPerson)(uid=helm.user@example.com))'
2022-02-03 02:33:45,262+0000 WARN  [qtp1045754506-9146]  *UNKNOWN org.sonatype.nexus.ldap.internal.connector.FailoverLdapConnector - Problem connecting to LDAP server:  Caused by: javax.naming.NamingException: LDAP connection has been closed; remaining name ''
org.sonatype.nexus.ldap.internal.connector.dao.LdapDAOException: Failed to retrieve information for user: helm.user@example.com
	at org.sonatype.nexus.ldap.internal.connector.dao.DefaultLdapUserDAO.getUser(DefaultLdapUserDAO.java:135)
	at org.sonatype.nexus.ldap.internal.connector.DefaultLdapConnector.getUser(DefaultLdapConnector.java:132)
	at org.sonatype.nexus.ldap.internal.connector.FailoverLdapConnector.getUser(FailoverLdapConnector.java:153)
	at org.sonatype.nexus.ldap.internal.realms.EnterpriseLdapManager.authenticateUser(EnterpriseLdapManager.java:139)
	at org.sonatype.nexus.ldap.internal.LdapRealm.queryForAuthenticationInfo(LdapRealm.java:101)
	at org.apache.shiro.realm.ldap.AbstractLdapRealm.doGetAuthenticationInfo(AbstractLdapRealm.java:200)
	at org.apache.shiro.realm.AuthenticatingRealm.getAuthenticationInfo(AuthenticatingRealm.java:571)
	at org.sonatype.nexus.security.authc.FirstSuccessfulModularRealmAuthenticator.doMultiRealmAuthentication(FirstSuccessfulModularRealmAuthenticator.java:59)
	at org.apache.shiro.authc.pam.ModularRealmAuthenticator.doAuthenticate(ModularRealmAuthenticator.java:275)
	at org.apache.shiro.authc.AbstractAuthenticator.authenticate(AbstractAuthenticator.java:198)
	at org.apache.shiro.mgt.AuthenticatingSecurityManager.authenticate(AuthenticatingSecurityManager.java:106)
	at org.apache.shiro.mgt.DefaultSecurityManager.login(DefaultSecurityManager.java:275)
	at org.apache.shiro.nexus.NexusWebSecurityManager.login(NexusWebSecurityManager.java:84)
	at org.apache.shiro.subject.support.DelegatingSubject.login(DelegatingSubject.java:260)
	at org.apache.shiro.web.filter.authc.AuthenticatingFilter.executeLogin(AuthenticatingFilter.java:53)
	at org.apache.shiro.web.filter.authc.HttpAuthenticationFilter.onAccessDenied(HttpAuthenticationFilter.java:230)
	at org.apache.shiro.web.filter.AccessControlFilter.onAccessDenied(AccessControlFilter.java:133)
	at org.apache.shiro.web.filter.AccessControlFilter.onPreHandle(AccessControlFilter.onPreHandle(162));
	at org.sonatype.nexus.security.authc.NexusBasicHttpAuthenticationFilter.onPreHandle(NexusBasicHttpAuthenticationFilter.java:86)
	at org.apache.shiro.web.filter.PathMatchingFilter.isFilterChainContinued(PathMatchingFilter.java:223)
	at org.apache.shiro.web.filter.PathMatchingFilter.preHandle(PathMatchingFilter.preHandle(198));
	at org.sonatype.nexus.security.SecurityFilter.executeChain(SecurityFilter.executeChain(96));
	at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.executeChain(450));
	at org.sonatype.nexus.security.SecurityFilter.doFilter(SecurityFilter.doFilter(112));
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.doFilter(82));
	at com.google.inject.servlet.DynamicFilterPipeline.dispatch(DynamicFilterPipeline.dispatch(104));
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.doFilter(82));
	at org.sonatype.nexus.internal.web.ErrorPageFilter.doFilter(ErrorPageFilter.doFilter(79));
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.doFilter(82));
	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.handle(602));
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.handle(127));
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.nextHandle(235));
	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.doHandle(1624));
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.handle(127));
	at com.codahale.metrics.jetty9.InstrumentedHandler.handle(InstrumentedHandler.handle(239));
	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.handle(146));
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.handle(127));
	at org.eclipse.jetty.server.server.Server.handle(Server.handle(516));
	at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.handle(388));
	at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.dispatch(633));
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.handle(380));
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.onFillable(277));
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection$ReadCallback.succeeded(311));
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.fillable(105));
	at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint$1.run(104));
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.runJob(883));
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool$Runner.run(1034));
	at java.lang.Thread.run(Thread.java:748);
```

## post by mpiggott on Feb 7, 2022

Your log says the LDAP connection was closed. Probably you should compare your LDAP server settings, and the settings you configured in Nexus. Or things between nexus and LDAP that may terminate the connection.

## post by abhilash.sandupatla on Feb 8, 2022

Does nexus oss have any default cache support?

I see in the very beginning of logs, due to cache information was not found, it was not able to find LDAP user.

For reference, I am attaching my nexus realms configuration

## post by wborn on Jan 20, 2023

We were having similar issues after our LDAP was relocated to another cloud service. What I think was happening for us is that all the LDAP connections in the pool are closed due to inactivity after a while. Then if Nexus tries to use such a connection it will throw the exception for each connection in the pool (causing retries to fail as well). We’ve seen similar issues for HTTP connection pooling in our own code.

You can tweak the LDAP connection pool using some system properties as listed here:

[https://docs.oracle.com/javase/jndi/tutorial/ldap/connect/config.html](https://docs.oracle.com/javase/jndi/tutorial/ldap/connect/config.html)

What seems to work for us is to remove idle connections after 5 minutes from the pool instead of the default behavior of keeping them forever.

I.e. add the `-Dcom.sun.jndi.ldap.connect.pool.timeout=300000` system property.

If you run Nexus using a Docker container this can be done by adding this property to the default `INSTALL4J_ADD_VM_PARAMS` as described in the [container documentation](https://hub.docker.com/r/sonatype/nexus3):

```yaml
    environment:
     - INSTALL4J_ADD_VM_PARAMS=-Xms2703m -Xmx2703m -XX:MaxDirectMemorySize=2703m -Djava.util.prefs.userRoot=/nexus-data/javaprefs -Dcom.sun.jndi.ldap.connect.pool.timeout=300000
```

## post by john.licalsi on Nov 10, 2023

What file did you add that parameter to?

## post by wborn on Nov 11, 2023

I launch Nexus using Docker Compose so I updated my `docker-compose.yml` file.